Mastering Kali Linux for Advanced Penetration Testing - Third Edition

Creating a Windows-specific exploit

To create a Windows-specific exploit, we must identify the right offset of the EIP. This can be extracted by exploit tools such as patter_offset, which takes the input of the EIP with the same length that was used to create the pattern:

root@kali:/usr/share/metasploit-framework/tools/exploit# ./pattern_offset.rb -q 0x6F43376F -l 4000
[*] Exact match at offset 2002

This means that an offset match was found in the pattern that was created with the EIP. Now, we know that buffer 2002 is enough to crash the server, and we can begin the overflow.

The next step is to find what EIP register stores the opcodes for the JMP ESP assembly. In the Immunity Debugger, view the executable modules and select essfunc.dll ...